COMMAND

    riched32.dll

SYSTEMS AFFECTED

    WinNT

PROBLEM

    Pauli Ojanpera found following.

        {\rtf\a112911112911112911112911...112911}

    1000 digits after 'a' should be enough.  Try more if not.  Crashes
    on NT4WS+SP6+Riched-patch.  This  works also by sending  a message
    having the  above string  in the  body from  hotmail to OE5 client
    version 5.50.3825.400 on NT4 server sp6.

    Having it in the subject causes funnies with the full outlook 2000
    client as well.  When  scrolling messages you will note  that this
    message(call  it  #2)  had  the  same  subject  that  the previous
    message(#1)  did,  although  the  window  title  had  been updated
    appropriately.   Moving on  to the  next message  (#3), and  going
    back again will left you with the subject from message #3  showing
    on  the  subject  line.   It  may  be possible to overflow Outlook
    itself by including  a carefully crafted  subject line.   This was
    Outlook version 9.0.0.2711 on NT 4 SP5.  Problems also noted  with
    Outlook 97 - version info: 8.04.5619 Windows NT Server - sp 6a.

SOLUTION

    Nothing yet.  Does not work in outlook 2000, 9.0.0.2711, win98-SE.